CVE-2017-5991
HighSummary
An issue was discovered in MuPDF before version 1912de5f08e90af1d9d0a9791f58ba3afdb9d465 related to a NULL pointer dereference in the pdf_run_xobject function during a Fitz fz_paint_pixmap_with_mask painting operation.
Risk Assessment
This vulnerability may lead to application crashes, potentially affecting the availability of services using MuPDF.
Recommendation
It is recommended to update MuPDF to version 1.11 or later to mitigate the risk associated with this vulnerability.
Other vulnerabilities in MuPDF
See all- CVE-2017-6060High
A stack-based buffer overflow in jstest_main.c in mujstest in Artifex Software, Inc. MuPDF 1.10a allows remote attackers to have unspecified impact via a crafted image.
- CVE-2016-6525Critical
A heap-based buffer overflow in the pdf_load_mesh_params function in MuPDF can be exploited by remote attackers. Exploiting this vulnerability may lead to denial of service or arbitrary code execution via a large decode array.
- CVE-2025-71382Medium
A vulnerability in MuPDF before version 1.27.0-rc1 allows a DoS attack via a specially crafted EPUB file with deeply nested HTML elements and inline CSS styles. The function value_from_inheritable_property() in css-apply.c recursively processes the CSS inheritance chain without a depth limit, exhausting the stack and causing a crash.
- CVE-2026-25556High
A double-free vulnerability in MuPDF versions 1.23.0 through 1.27.0 exists in the fz_fill_pixmap_from_display_list() function during error handling. The function incorrectly drops a caller-owned fz_pixmap pointer in its error path before rethrowing the exception, leading to a double-free that can corrupt the heap and crash the process.
- CVE-2025-46206Medium
An infinite recursion vulnerability was found in Artifex MuPDF versions 1.25.5 and 1.25.6 within the `mutool clean` utility. A remote attacker can cause a denial of service (DoS) by supplying a crafted PDF file with cyclic /Next references in the outline structure.
Original NVD description (English source)
An issue was discovered in Artifex MuPDF before 1912de5f08e90af1d9d0a9791f58ba3afdb9d465. The pdf_run_xobject function in pdf-op-run.c encounters a NULL pointer dereference during a Fitz fz_paint_pixmap_with_mask painting operation. Versions 1.11 and later are unaffected.